As of 30 October 2026, there is no court finding on who hacked Binance. The attribution available is an investigators' claim: TRM Labs traced the 29 October 2026 breach to a North Korean unit called TraderTraitor, and other trackers also pointed to North Korea. That is the strongest attribution reported so far, but it is not a proven legal conclusion.

The distinction between a trace and a court finding matters. Blockchain tracing can follow funds across wallets and look for patterns linked to known actors, but it does not carry the same weight as evidence tested in court. Readers should therefore treat the TraderTraitor claim as an investigators' assessment, not as a settled verdict about who was responsible.

Pyongyang's position should also be recorded. North Korea has previously denied hacking allegations, and that denial is part of the public record on claims of this kind. Including it does not settle the question either way; it simply shows that the attribution is contested in the way such claims often are.

What is not in dispute is the scale of the incident. The breach is estimated at about $6.3 billion, the largest crypto theft on record, surpassing Bybit's $1.5 billion loss in 2025. The size alone explains why tracing firms, exchanges, and stablecoin issuers moved quickly, whatever the final attribution turns out to be.

The preliminary mechanism gives investigators something concrete to trace. A compromised DevOps engineer's laptop may have let an attacker access a service container and submit unauthorised withdrawal transactions, and no evidence of a wallet private key leak has been found so far, on a preliminary basis. Reports also say Ethereum feature EIP-7702 was used to turn the Binance 14 wallet into a sweeper, moving around 204,500 ETH.

The freezing response shows how attribution and recovery interact. About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC, with Tether freezing more than $1.567 billion in USDT, Circle about $823 million in USDC, Ripple about $200 million, and World Liberty Financial $27 million in USD1. Freezes can happen without a court finding on attribution, because issuers can act on their own risk assessments.

Market reaction was immediate regardless of who was responsible. Bitcoin fell below $77,000, down about 4.5 percent in 24 hours to $76,664 and later around $77,984, ether fell about 3.2 percent, BNB about 3.9 percent, and more than $1 billion in leveraged positions was liquidated in 24 hours. Markets react to the loss itself, not only to the name attached to it.

Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. The next proof-of-reserves snapshot, due on 1 November 2026, will show whether stolen assets were replaced. For the latest confirmed developments, readers should rely on official Binance channels.

FAQ: Who hacked Binance? Investigators claim the North Korean unit TraderTraitor, according to TRM Labs, with other trackers also pointing to North Korea. Is that a court finding? No, it is an investigators' claim, not a court finding. Has North Korea denied hacking allegations before? Yes, Pyongyang has previously denied such allegations.